Safety reactor protection system

Integrated control system This includes various safety, monitoring, and control systems, including a reactor protection system. 

NUREG/CR-6101, Software Reliability and Safety in Nuclear Reactor Protection Systems, Nov. 1993... 

There are five safety systems in Lungmen DCIS. They are Reactor Protection System (RPS), Neutron Monitor System (NMS), Process Radiation Monitoring System (PRMS), Containment Monitoring System (CMS), and Engineered Safety Features (ESF). The software development for all these safety systems follows the BTP-14 requirements. Along with the development, the IV V activities are performed. Of the safety systems, RPS, NMS, PRMS and CMS are designed by GE NUMAC, and ESF is sub-contracted by GE to Eaton Corporation. 

The safety system consists of 4 divisions and the 2 out of 4 logic is employed. As for consideration for common mode failures, some hard-wired back-up countermeasures were installed based on the defense-indepth concepts. Figure 2 and 3 show the configuration of RPS (Reactor Protection System) and LSF (Lngineering Safety Features), respectively. 

Common requirements for the reactor protection system, engineered safety features actuation system and emergency load sequencer on one side, and for the reactor limitation system on the other side have been set forth in the following areas ... 

Since the number of LOR and scram during high power operations was very high, an exercise was carried out to optimize the trip parameters. As a first step, high winding temperature trips of sodium pump drive system motors (88 No) were deleted and control panels of these systems were housed in an air conditional atmosphere. These steps have vastly improved performance of the drive system. As second step the trip parameters of reactor protection system were reviewed and the following modifications were carried out to improve the reliability of the system without compromising the safety. 

Figure 1 provides a schematic view of typical TS for Safety-Related Equipment (SRE) of a NPP, which consists of several sections (both LCO and SR are shown in detail) as presented in Martorell et al. (2004). Herein, for sake of clarity in the presentation it will be considered the case of the RPS (Reactor Protection System) of a Pressurized Water Reactor (PWR). 

Chapter 15 lists the assumptions used in the turbine trip e analysis. These assumptions are chosen so that they tend to maximize the required pressure relieving capacity of the primary and secondary valves. The analysis demonstrates that sufficient relieving capacity has been provided so that when acting in conjunction with the reactor protective system the safety valves will prevent the pressure from exceeding 110% of the design pressure. 

Overpressurization of the Reactor Coolant System (RCS) and steam generators is precluded by means of primary safety valves, secondary safety valves and the Reactor Protection System (RPS). Pressure relief capacity for the steam generators and RCS is conservatively sized to satisfy the overpressure requirements of the ASME Boiler and Pressure Vessel Code, Section III. The safety valves in conjunction with the RPS, are designed to provide overpressure protection for a loss-of-load incident with a delayed reactor trip. 

The System 80+ Standard Design, steam generators, and reactor coolant system are protected from overpressurization in accordance with the guidelines set forth in the ASME Boiler and Pressure Vessel Code, Section III. Peak reactor coolant system and secondary system pressures are limited to 110% of design pressures during a worst case loss load event. Overpressure protection is afforded by primary safety valves, secondary safety valves, and the Reactor Protection System. 

The design of the plant should be tolerant of human error. To the extent practicable, any inappropriate human actions should be rendered ineffective. For this purpose, the priority between operator action and safety system actuation should be carefully chosen. On the one hand, the operator should not be allowed to override reactor protection system actuation as long as the initiation aiteria for actuation apply. On the other hand, there are simations where operator interventions into the protection system are necessary. Examples are manual bypasses for testing purposes or for adoption of acmation criteria for modifications to the operational state. Furthermore, the operator should have an ultimate possibility, under strict administrative control, to intervene in the protection system for the purposes of managing beyond design basis accidents in the event of major failures within the reactor protection system. 

The status of safety-related systems and fiinctions is presented in a similar way, in accordance with the organization of the Emergency Operation Procedures (EOP). The parameters that are of immediate interest in a disturbance situation, are presented in a direct form. This means that the reactor pressure vessel with in- and outflow connections, together with neutron flux, water level, and reactor pressure, as well as control rods fiilly in (or not), are displayed directly. Other safety functions are indicated as normal, disturbed or failed in a similar way as for the plant overview, with detailed information at the reactor operator s desk. In this context, it can be noted that the computer-based reactor scram function via the reactor protection system (RPS) has been supplemented by a scram backup system that is implemented in hard-wired equipment. 

As in the case of the emergency cooling systems, the safety-related auxiliary electrical power supply equipment is divided into four independent and physically separated parts, or subdivisions, and the reactor protection system operates on a 2-out-of-4 logic for signal transmission and actuation. 

The computer system of the station control and data acquisition is a distributed micro processer based systems. A digital multiplexed control system takes the place of hard wired analogue control. This accounts for a significant reduction in cable usage. Built-in diagnostics and board level maintenance makes restoration of operability of any fault in the system a matter of replacement of printed circuit cards. Automatic control systems and procedures are deployed to simplify these procedures and power level manoeuvers. In case of unsafe conditions the reactor protection system (PMS) takes over and automatically scrams the reactor and actuates the relevant safety systems. Diverse methods are used to assure the shutdown of the reactor in hypothetical situations. The systems also provide for post-accident monitoring. 

In case of unsafe conditions the reactor protection system takes over and automatically scrams the reactor and actuates the relevant safety systems. The reactor protection system includes the reactor trip system and the engineered safety features actuation system. 

The PIUS plant is also provided with instrumentation systems, protection, logic, and actuation systems for reactor shutdown, residual heat removal, containment isolation, etc. in a similar way as present-day LWR plants. Their importance for ensuring safety is significantly reduced in a PIUS plant. The equipment of these instrumentation, monitoring, protection, and actuation systems is separated from that of other systems and located in separate, physically well protected compartments at the bottom of the reactor building. The reactor protection system (RPS), with a two-out-of-four coincidence logic, has the task of initiating power level reduction, reactor shutdown or reactor scram when reactor process parameters exceed set limits, in order to prevent further departure from permissible conditions. 

The remaining safety-grade functions are performed by the reactor protection system (it initiates opening of the scram valves to achieve a reactor scram), the containment isolation system (it initiates isolation of the containment by closing isolation valves), the reactor vessel safety valves (based on pressure-activated components), and the passive reactor pool cooling function. These functions are not needed for the protection of the core, however. 

The instrumentation and control system consists of the reactor protection system, engineered safety features opmtion system, plant control system and reactor monitoring system. The reactor protection syston has two diverse shutdown ems. The engineered safety features are the decay heat removal system (PRACS) and the containment system. 

The Plant Protection System (PPS) consists of the Reactor Protection System (RPS) and the Engineered Safety Features Actuation System (ESFAS) (see CESSAR-DC Section 7.1.1.1). 

The System 80+ Standard Design utilizes offsite and onsite power systems to supply the unit auxiliaries during normal operation, and these plus the Reactor Protection System and Engineered Safety Features Systems during abnormal and accident conditions. In addition, the onsite and offsite power systems are designed in accordance with accepted industry codes and standards (see CESSAR-DC Section 8.0), and do not employ load break switches. 

RCS and steam system overpressure protection during power operation are provided by the pressurizer safety valves and the steam generator safety valves, in conjunction with the action of the reactor protection system. Combinations of these systems provide compliance with the overpressure protection requirements of the NRC for PWR... 

Reactor protection system and instmmentation for other safety systems... 

Operability requirements should be stated for the reactor protection system and for instrumentation and logic for other safety systems, together with limits on response times, instrument drift and accuracy, where appropriate. Interlocks teqnired by the safety analysis report should be identified and relevant operability reqnire-ments should be stated. 

The reactor protection system and engineered safety features component control system use fiber-optic technology for isolation between protection system channels and equipment, cabinets and operator interface devices in the main control room. If an isolation error occurs, an appropriate error message is generated and diagnostic tests are then applied to isolate the cause of the error. This would include errors caused by the leakage through a fiber-optic isolator. 

The instrumentation and control systems important to safety fall into the following categories reactor protection systems, engineered safety features control systems, safe shutdovwi control systems and other information systems, control systems, and essential auxiliary systems important to safety. Appropriate surveillance procedures and setpoint methodology for instrumentation and control systems important to safety are required to ensure the system operability. 

The safety requirements also include the necessaiy restrictions regarding maintenance work on the reactor protection system and on vital I C during the different plant operating states. 

The plant model includes eight different safety systems that are mostly four-redundant. The safety systems are divided into two separate subsystems Reactor Protection System (RPS) and Diverse Protection System (DPS), which are implemented on different automation hardware. The RPS safety systems are automatic depressurisation system (ADS), component cooling water system (CCW), emergency core cooling system (ECC), service water system (SWS) and residual heat removal system (RHR). The DPS safety systems are emergency feed water system (EFW), and main feed water system (MFW). In addition, the AC power system belongs to both RPS and DPS. The model describes the operation logic of the safety systems, the hardware equipment used to implement each system, and the associated failure modes for each piece of equipment. 

The results of the analysis show that the overtemperature AT reactor protection system signal provides adequate protection against the reactor coolant system depressurisation events. The calculated DNBR remains above the design limit. The long-term plant response due to a stuck-open ADS valve or pressuriser safety valve, which cannot be isolated, is bounded by the small-break LOCA analysis. 

The relief capacities of the pressuriser safety valve is determined from the postulated overpressure transient conditions in conjunction with the action of the reactor protection system. An overpressure protection report is prepared according to Article NB-7300 of Section III of the ASME code. Reference 6.2 describes the analytical model used in the analysis ofthe overpressure protection system and the basis for its validity. 

The diverse reactor protection system (RPS) design should be developed by a different team, using independently derived safety functional requirements ... 

The possibUity of bypassing interlocks and trips of the reactor protection system shall be carefully evaluated and appropriate means of protecting interlocks and trips that are important to safety from being inadvertently bypassed shall be incorporated into the reactor protection system. 

It shall be ensured in the design that the set points can be established with a margin between the initiation point and the safety limits such that the action initiated by the reactor protection system will be able to control the process before the safety limit is reached. Some of the factors in establishing this margin are ... 

For reactor systems that use flappers " or equivalent systems for natural circulation cooling, and for which this mode is part of the safety system (or is considered an engineered safety feature), an appropriate number of redundant devices shall be used (in application of the single failure criterion), including devices to verify the functioning and to provide signals to the reactor protection system. 

If safety devices are interconnected with the reactor protection system, they shall be designed to maintain the quality of the reactor protection system. The possibility of deleterious interactions with the reactor protection system shall be assessed. 

To provide and present to the reactor operator enough information to determine readily the status of the reactor protection system and to take the correct safety related actions... 

Developing or upgrading safety systems, reactor protection systems and instrumentation systems to minimize equipment malfunctions and operator errors that could potentially lead to beyond design basis events or severe accidents ... 

Reactor protection system The purpose of this system is to dnit the reactor down and bring it to a safe condition when any of the safety thresholds are crossed. Two types of safety actions are planned viz. continuous lowering of all 9 CSR or gravity drop of all 9 rods. The diverse safety rods are designed for gravity drop. Both the primary and secondaiy shutdown systems receive all plant inputs required for safety. Redundancy and diversity is provided and 2/3 logic is followed. 

Passive reactivity shutdown The plant control system (PCS) causes the reactor to follow load demand, and normally will maintain the core outlet sodium temperature within specified limits. If an emergency event develops too rapidly for the PCS to control it, then the safety-grade reactor protection system (RPS), located at the reactor module, will independently respond by causing a reactor scram (rapid insertion of the nine control rods). The RPS includes substantial internal diversity and redundancy and is expected to be Mghly... 

---